Cookie Problem

[The Little Guy]

OK, I have a form, for a login, if it finds that the username and password match, it saves some info in a session, then creates a cookie with the user's username in it.

 

my problem is that in order to be redirected to users.php, I need to login 2 times.

to see what I mean, go here: http://tzfiles.com

User Name: demo

Password: demo12

 

If an incorrect password is entered, no cookie is saved, if a correct password is entered it saves a cookie and asks you to login again.

 

<?php include'db.php';
if(isset($_POST['login'])){
if(isset($_COOKIE['userName'])){
	$user = $_COOKIE['userName'];
}
if(isset($_POST['user'])){
	$user = $_POST['user'];
}
$sql = mysql_query("SELECT * FROM users WHERE user='".addslashes($user)."' AND pass='".base64_encode($_POST['pass'])."'")or die(mysql_error());
if(mysql_num_rows($sql) > 0){
	$row = mysql_fetch_array($sql);
	session_start();
	$_SESSION['user'] = $row['user'];
	$_SESSION['first'] = $row['fname'];
	$_SESSION['last'] = $row['lname'];
	$_SESSION['id'] = $row['id'];
	$_SESSION['email'] = $row['email'];
	$_SESSION['sort_by'] = $row['sort_by'];
	$_SESSION['fpp'] = $row['files_per_page'];
	$_SESSION['group'] = $row['group'];
	$_SESSION['logged'] = 1;
	setcookie("userName", $row['user'], time()+60*60*24*7);
	header("Location: ../user.php");
	exit;
}
}
?>

[trq]

Can we see where you validate a user in user.php?

 

Also, be aware that the Location header expects a url, not a relative path.

[The Little Guy]

<?php include'../db.php';
session_start();
if($_SESSION['logged'] != 1){
header("Location: ../login.php");
}
?>

 

I always use a relative path, and it works.

[trq]

I always use a relative path, and it works.

 

Yeah, it will work most of the time. Anyway, thats not your problem and to be honest, I don't see what your problem might be.

[The Little Guy]

did you go to the site, and try to login with the information I gave?

[trq]

Yes, and I experience the problem you describe.

[The Little Guy]

I found out, that it logs the user in, but it doesn't take them to their user page, just back to the home page.

 

I tried changing the header to this:

 

header("Location: http://tzfiles.com/user.php");

 

still doesn't work.

[The Little Guy]

As long as you have attempted to login, you can change the user name it will work.

 

Basically it seems that it requires at least one attempt before it will allow you to see the users.php page.